budibase

v3.39.15 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Developer Productivity

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai-app-builder ai-applications crud-app crud-application data-application data-apps

+12 more

internal-tools it-workflows low-code low-code-no-code low-code-platform no-code no-code-platform rest-api-framework sql-gui workflow-apps workflow-automation workflow-engine

Affected surfaces

auth

ReleasePort's take

Moderate signal

editorial:auto 1mo

ReleasePort Layer 1 version 3.39.15 adds an `exp` field to auth JWT tokens, limiting their validity.

Why it matters: The new `exp` claim enforces token expiration, mitigating the risk of indefinite access; critical for all services using JWT authentication.

Summary

AI summary

Add exp field to auth JWTs to prevent indefinite token validity

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Adds exp field to auth JWTs to prevent indefinite token validity Adds exp field to auth JWTs to prevent indefinite token validity Source: llm_adapter@2026-06-15 Confidence: high	—
Dependency	Low	Bumps @grpc/grpc-js from 1.14.3 to 1.14.4 in all-non-major-security group Bumps @grpc/grpc-js from 1.14.3 to 1.14.4 in all-non-major-security group Source: llm_adapter@2026-06-15 Confidence: high	—
Bugfix	Medium	Prevents Front widget from covering dev data banner close button Prevents Front widget from covering dev data banner close button Source: llm_adapter@2026-06-15 Confidence: high	—

Full changelog

What's Changed

[VUL-79] Add exp field to auth JWTs to prevent indefinite token validity by @jvcalderon in https://github.com/Budibase/budibase/pull/18958
fix: prevent Front widget from covering dev data banner close button by @aakashgautam-git in https://github.com/Budibase/budibase/pull/18972
build(deps): bump @grpc/grpc-js from 1.14.3 to 1.14.4 in the all-non-major-security group across 1 directory by @dependabot[bot] in https://github.com/Budibase/budibase/pull/18966

New Contributors

@aakashgautam-git made their first contribution in https://github.com/Budibase/budibase/pull/18972

Full Changelog: https://github.com/Budibase/budibase/compare/3.39.14...3.39.15

Security Fixes

[VUL-79] Add exp field to auth JWTs — prevents indefinite token validity

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track budibase

Get notified when new releases ship.

About budibase

AI agents that run your operations. Model agnostic.

All releases →